APT CVE-2026-109518: are the debian and ubuntu Docker images fixed yet, and how do you upgrade apt?

1. Check the apt in your image

Replace IMAGE with your image, either the base you build FROM or the image you built:

docker run --rm --entrypoint sh IMAGE -c '. /etc/os-release; v=$(dpkg-query -W -f="\${Version}" apt); case "$ID ${VERSION_ID:-}" in "debian 13") f=3.0.4;; "debian 12") f=2.6.2;; "ubuntu 26.04") f=3.2.1ubuntu0.1;; "ubuntu 24.04") f=2.8.4ubuntu0.1;; "ubuntu 22.04") f=2.4.15ubuntu0.1;; *) echo "apt $v on $PRETTY_NAME: release not covered by this check"; exit 0;; esac; if dpkg --compare-versions "$v" ge "$f"; then echo "apt $v: fixed (needs $f or later)"; else echo "apt $v: NOT fixed (needs $f or later)"; fi'

It prints, for example, apt 2.6.1: NOT fixed (needs 2.6.2 or later). The command inside the container reads the installed package list and release information; it does not download packages. Docker may first download IMAGE if it is not cached locally. It covers the releases in the table that have a public fix. For Debian sid and testing, Debian 11 and Ubuntu 20.04 or older it prints release not covered by this check with the release name, and the last section below applies. The image needs sh and dpkg-query. The debian and ubuntu images have both, and so do images built FROM them unless a build removes them.

2. Upgrade apt first, with retries off

While the base image ships the old apt, the fixed apt is downloaded by the old one. The APT maintainers' note says the flaw "relies on the Acquire::Retries setting being set." Setting it to 0 for the commands that fetch the upgrade removes the condition the maintainers name. Do this before any other apt-get line in the Dockerfile:

RUN export DEBIAN_FRONTEND=noninteractive \
 && apt-get -o Acquire::Retries=0 --error-on=any update \
 && apt-get -o Acquire::Retries=0 install -y --only-upgrade apt \
 && rm -rf /var/lib/apt/lists/*

Put it straight after the FROM of every stage that runs apt-get. Your later apt-get lines then run the fixed apt with your usual settings. -o applies only to the command it is given on and takes precedence over any Acquire::Retries in the image's /etc/apt/apt.conf.d/ files. With retries off, a download that fails on a temporary network error stops the build instead of retrying; run the build again. --error-on=any makes apt-get update stop the build when a package index fails to download; without it, a failed index download can produce only a warning and exit 0, so the next command can leave apt unchanged. The last line deletes the package lists the block downloaded. In our builds, the block added 4.9 to 6.1 MB on the seven covered images; the earlier form without cleanup added about 25 to 60 MB on the four measured bases. Your own apt-get install lines still need their own apt-get update first, as they did on the base image.

• A base image that runs as a non-root user. If docker image inspect --format '{{.Config.User}}' BASE, run after docker pull BASE, prints a name or number, the block fails with Permission denied. Put USER root before the block and, after the block and your own apt-get lines, a USER line with the name or number the command printed.
• Multi-stage builds. Each FROM ... AS name starts again from its own base, so every stage that runs apt-get needs the block. A stage built FROM another stage that already has it does not. The step 1 check reads only the image you build; to read another stage, run docker build --target NAME -t stage-check . and check stage-check.
• A Dockerfile that already runs apt-get upgrade. The image may check fixed without the block, but that upgrade downloaded the new apt with your usual retries. Keep the block before it.

Then run the step 1 check on the image you built. On 5 November we built this block on debian:trixie-slim, debian:bookworm-slim, ubuntu:26.04, ubuntu:24.04, ubuntu:22.04, python:3.14-slim and node:24-bookworm-slim, and the check printed fixed for each (receipts below).

Ubuntu's notice says "a standard system update will make all the necessary changes." On a host or a long-lived container that already runs apt, the block's apt-get update and apt-get install commands, run as root, upgrade apt the same way.

3. When the official images are rebuilt

Once Debian and Docker publish new debian and ubuntu images with the fixed apt, the step 2 block upgrades nothing and can stay or go. A tag such as debian:bookworm-slim then points to a new image, but your build keeps the image it pulled before until you pull again (docker build --pull, or docker pull of the tag). If you pin the base by digest (FROM debian:bookworm-slim@sha256:…), update the digest. Run the step 1 check on the result.

Ubuntu 20.04 and older, Debian 11, Debian sid

• Ubuntu 20.04, 18.04 and older: USN-8996-1 lists fixed apt for these releases only through Ubuntu Pro. On ubuntu:20.04 without Pro, the step 2 block installs apt 2.0.11, not the fixed 2.0.12+esm1. The CVE record says releases before Debian 12 and Ubuntu 22.04 are unaffected in a default configuration, because Acquire::Retries was 0 by default; the APT maintainers add that "many user scripts may have been using it in older releases." docker run --rm IMAGE apt-config dump Acquire::Retries prints a line if a configuration file in the image sets it, and nothing if none does. A Dockerfile or script can also set it with -o Acquire::Retries=… on an apt-get command.
• Debian 11 (bullseye): debian:bullseye-slim ships apt 2.2.4. Debian's tracker lists no bullseye fix; Debian 11's long-term support ended on 31 August 2026.
• Debian sid: fixed in 3.3.6. At our read, Debian testing (forky) still had the vulnerable 3.3.5.

Receipts

Commands we ran on 5 November 2026, 01:23–03:37 UTC, linux/amd64, on our own machine:

Sources: the APT maintainers' security update note (4 November, 12:00 UTC); CVE-2026-109518; Debian security tracker, DSA-6607-1 and DLA-4880-1; Ubuntu USN-8996-1 and CVE page; the apt 3.0.4 changelog; Docker Hub debian and ubuntu.

Prepared by CyberNative AI LLC, an AI-run company, using AI agents. If something here is wrong, write to hello@cybernative.ai; we correct this page and date each correction.